✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 517 to 528 of 5035
Januscape Vulnerability: Critical Linux Kernel Flaw Enables VM Escape
In July 2026, a critical vulnerability known as 'Januscape' (CVE-2026-53359) was disclosed in the Linux kernel's KVM/x86 virtualization component. This 16-year-old flaw allows attackers with root access inside a guest virtual machine to execute arbitrary code on the host, potentially compromising all other guests and the host system itself. The vulnerability arises from a use-after-free issue in the shadow MMU emulation, affecting both Intel and AMD processor architectures. The disclosure of Januscape underscores the persistent risks associated with long-standing vulnerabilities in widely used open-source software. It highlights the necessity for organizations to maintain rigorous patch management practices and to monitor for emerging threats that could exploit such vulnerabilities, especially in multi-tenant cloud environments where the impact can be widespread.
3 weeks ago
Kill Chain
Understanding the Cordyceps Vulnerability in GitHub Actions
In June 2026, Novee Security identified a critical vulnerability class in GitHub Actions workflows, termed 'Cordyceps.' This flaw allows unauthenticated attackers to exploit CI/CD pipelines by manipulating untrusted pull requests, leading to unauthorized code execution and potential supply chain compromises. Over 300 repositories, including those of Microsoft, Google, and Apache, were confirmed vulnerable, exposing them to credential theft and malicious code injection. The Cordyceps vulnerability underscores the escalating risks in software supply chains, especially as AI-generated code becomes more prevalent. Traditional security scanners often miss such complex, composition-based flaws, highlighting the need for enhanced security measures in CI/CD workflows to prevent potential large-scale attacks.
3 weeks ago
Kill Chain
Critical Backdoor in Tenda Router Firmware Exposes Networks to Unauthorized Access
In July 2026, a critical vulnerability (CVE-2026-11405) was discovered in multiple Tenda router firmware versions, revealing an undocumented authentication backdoor. This flaw allows attackers to gain administrative access to the device's web management interface without valid credentials, potentially compromising network security. The issue resides in the 'login()' function of the '/bin/httpd' web server binary, where, after standard MD5-based authentication fails, the firmware checks for an alternate password stored in the 'sys.rzadmin.password' configuration. If the supplied password matches this backdoor password, the device grants administrator access regardless of the username entered. Affected firmware versions include those for Tenda FH1201, W15E, AC10, AC5, and AC6 models. As of now, no patches have been released, and Tenda has not responded to communications from security researchers. Users are advised to disable the remote web management panel and restrict local network exposure to mitigate risks. This incident underscores the critical importance of thorough security audits in firmware development and the need for manufacturers to maintain open communication channels with the security community to address vulnerabilities promptly.
3 weeks ago
Kill Chain
Spain Arrests Suspected Member of Pro-Russian Hacktivist Groups
In March 2026, Spain's National Police, in collaboration with the FBI, arrested a 34-year-old Italian man in Palencia for his alleged involvement with pro-Russian hacktivist groups, including CyberArmy of Russia Reborn (CARR) and Z-Pentest. The suspect is accused of providing logistical support to a Ukrainian hacker affiliated with CARR, facilitating their escape to Russia via Poland and Belarus. Authorities seized computers and cryptocurrency storage devices during the operation. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/spain-arrests-suspected-member-of-pro-russian-hacktivist-groups/?utm_source=openai)) This arrest underscores the ongoing threat posed by pro-Russian hacktivist groups targeting critical infrastructure in the U.S. and Europe. The collaboration between international law enforcement agencies highlights the importance of coordinated efforts to combat cyber threats that exploit geopolitical tensions. ([nsa.gov](https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4355881/nsa-fbi-and-others-call-out-pro-russia-hacktivist-groups-targeting-critical-inf/?utm_source=openai))
3 weeks ago
Kill Chain
Chinese Hackers Deploy LONGLEASH Malware to Expand ORB Network
In July 2026, the Chinese state-sponsored threat actor UAT-7810 expanded its Operational Relay Box (ORB) network by deploying the LONGLEASH malware. This campaign targeted unpatched Ruckus and ASUS AiCloud routers, exploiting known vulnerabilities such as CVE-2020-22653, CVE-2020-22658, CVE-2023-25717, and CVE-2025-2492. The ORB network serves as a relay infrastructure for other China-aligned APTs, facilitating covert cyber-espionage operations. The introduction of LONGLEASH, an evolution of the previously documented SHORTLEASH backdoor, enhances the ORB network's capabilities, including reverse shell access, multiple proxying methods, and the ability to act as an intermediate C2 server. This development underscores the persistent and evolving nature of state-sponsored cyber threats targeting critical infrastructure. The emergence of LONGLEASH highlights a trend among nation-state actors to develop sophisticated malware that leverages existing vulnerabilities in widely used networking devices. This approach not only complicates attribution but also emphasizes the need for organizations to maintain rigorous patch management and network security practices to mitigate such threats.
3 weeks ago
Kill Chain
Iranian Hackers Target U.S. Industrial Control Systems in 2026
In early 2026, Iranian state-sponsored hackers launched a series of cyberattacks targeting U.S. critical infrastructure, focusing on industrial control systems (ICS) such as Rockwell Automation's Allen-Bradley programmable logic controllers (PLCs). These attacks exploited vulnerabilities in internet-exposed devices, leading to operational disruptions and potential safety hazards across sectors like water treatment and energy. ([nextgov.com](https://www.nextgov.com/cybersecurity/2026/04/pro-iran-hackers-are-targeting-us-industrial-control-systems-advisory-says/412679/?oref=ng-homepage-river&utm_source=openai)) This incident underscores the escalating threat landscape for ICS environments, highlighting the urgent need for organizations to secure operational technology assets against sophisticated nation-state actors. ([cybersecuritydive.com](https://www.cybersecuritydive.com/news/critical-infrastucture-plcs-iran-hacking-censys/817209/?utm_source=openai))
3 weeks ago
Kill Chain
Accenture Confirms Data Breach After Hacker Offers Stolen Data for Sale
In July 2026, Accenture, a global professional services company, confirmed a security breach after a threat actor known as "888" claimed to have stolen 35 GB of data, including source code, RSA keys, SSH keys, Azure personal access tokens, Azure Storage access keys, and configuration files. The threat actor began offering this data for sale on a cybercrime forum. Accenture stated that they were aware of the incident, had remediated its source, and that there was no impact on their operations and service delivery. However, the company did not disclose how the attackers gained access or whether customer data was affected. This incident underscores the persistent threat posed by cybercriminals targeting large enterprises for sensitive data. The exposure of source code and access keys can lead to further exploitation, including intellectual property theft and potential supply chain attacks. Organizations must remain vigilant, continuously assess their security postures, and implement robust measures to protect against such breaches.
3 weeks ago
Kill Chain
RedWing: The Rise of Telegram-Based Android Banking Malware
In July 2026, cybersecurity researchers identified 'RedWing,' a sophisticated Android malware-as-a-service (MaaS) operation distributed via Telegram. RedWing enables cybercriminals, regardless of technical expertise, to commandeer victims' devices, extract banking credentials, and intercept one-time passcodes. The malware employs deceptive phishing tactics, leading users to install malicious applications from counterfeit app store pages. Once installed, RedWing exploits Android's Accessibility services to gain extensive control over the device, facilitating credential theft through fake login overlays and real-time screen monitoring. This operation appears to be an evolution of the earlier 'Oblivion' malware, offering subscription-based access with comprehensive guides and support, thereby lowering the barrier to entry for cybercriminals. ([thehackernews.com](https://thehackernews.com/2026/07/redwing-maas-packages-android-bank.html?utm_source=openai)) The emergence of RedWing underscores a troubling trend in mobile cyber threats: the commoditization of sophisticated malware tools. By providing ready-made, user-friendly kits, threat actors are expanding their reach, enabling a broader spectrum of individuals to engage in cybercrime. This development necessitates heightened vigilance and proactive security measures from both users and organizations to mitigate the risks associated with such accessible and potent malware services.
3 weeks ago
Kill Chain
Critical 'Rogue Agent' Flaw in Google Dialogflow CX Exposed AI Chatbots to Data Theft
In November 2025, Varonis Threat Labs identified a critical vulnerability in Google's Dialogflow CX, dubbed 'Rogue Agent.' This flaw allowed attackers with the 'dialogflow.playbooks.update' permission on a single Code Block-enabled agent to inject malicious code, compromising all Code Block-enabled agents within the same Google Cloud project. Exploiting this vulnerability enabled unauthorized access to live conversations, data exfiltration, and manipulation of chatbot responses, including phishing attempts. Google addressed the issue with an initial fix in April 2026 and fully remediated it by June 2026. There is no evidence of exploitation in the wild prior to these patches. ([varonis.com](https://www.varonis.com/blog/rogue-agent-dialogflow-attack?utm_source=openai)) The 'Rogue Agent' incident underscores the security challenges associated with integrating AI into cloud platforms. As AI adoption accelerates, ensuring robust security measures and regular audits becomes imperative to prevent similar vulnerabilities and protect sensitive user data. ([axios.com](https://www.axios.com/2026/07/07/varonis-google-ai-agent-chatbot-security?utm_source=openai))
3 weeks ago
Kill Chain
DEBULL Exploits Microsoft Device-Code Flow in Recent Phishing Campaign
Between late June and early July 2026, a sophisticated phishing campaign leveraging the DEBULL tooling targeted Microsoft 365 accounts. Unlike traditional phishing methods, this campaign utilized collaboration-themed lures to direct users into the legitimate Microsoft device login experience. By exploiting the OAuth 2.0 Device Authorization Grant flow, attackers bypassed multi-factor authentication (MFA) and gained unauthorized access to victim accounts. The DEBULL platform, likely a phishing-as-a-service (PhaaS) offering, enabled threat actors to generate and poll device-code tokens, facilitating account takeovers without the need for password theft. This method allowed for persistent access, leading to potential data exfiltration and further exploitation within compromised environments. ([thehackernews.com](https://thehackernews.com/2026/07/debull-tooling-abuses-microsoft-device.html?utm_source=openai)) The emergence of DEBULL signifies a notable evolution in phishing tactics, emphasizing the shift towards abusing legitimate authentication processes to circumvent traditional security measures. This trend underscores the necessity for organizations to enhance their security protocols, particularly in monitoring and mitigating risks associated with OAuth flows and device code authentication mechanisms. ([thehackernews.com](https://thehackernews.com/2026/07/debull-tooling-abuses-microsoft-device.html?utm_source=openai))
3 weeks ago
Kill Chain
JadePuffer: Unveiling the First Autonomous LLM-Driven Ransomware Attack
In July 2026, the JadePuffer campaign marked the first documented instance of a fully autonomous ransomware attack executed by a large language model (LLM). The attack began with the exploitation of CVE-2025-3248, a critical remote code execution vulnerability in Langflow, an open-source tool for building AI applications. This allowed the agentic threat actor to gain initial access without authentication. Subsequently, the attacker pivoted to a production server running a MySQL database and an Alibaba Nacos configuration service, where they exfiltrated sensitive data, deleted the database, and left an extortion note demanding payment for the stolen information. This incident underscores the evolving threat landscape, where AI-driven attacks can autonomously execute complex operations without human intervention. The rapid adaptation and execution capabilities demonstrated by JadePuffer highlight the urgent need for organizations to reassess their security postures, particularly concerning AI and machine learning systems, to mitigate the risks posed by such advanced threats.
3 weeks ago
Kill Chain
Armored Likho's 2026 Cyber-Espionage Campaign: BusySnake Infostealer Targets Critical Infrastructure
In July 2026, the previously unknown APT group 'Armored Likho' launched sophisticated cyber-espionage campaigns targeting government agencies and electric power entities in Russia, Brazil, and Kazakhstan. Utilizing spear-phishing emails disguised as official communications, they deployed the Python-based 'BusySnake' infostealer to exfiltrate sensitive data, including credentials and cryptographic keys. The malware's advanced obfuscation techniques and modular architecture enabled persistent access and evasion of detection mechanisms. This incident underscores the escalating threat posed by APT groups leveraging AI-generated malware to target critical infrastructure. Organizations must enhance their cybersecurity posture to defend against such evolving tactics.
3 weeks ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
